WordPress Sites, SQL Server, and Your Web Stack: The Patch Queue That Can't Wait
Three vulnerabilities under active exploitation. Two of them directly relevant to the technology stack that the majority of UK small businesses run. One of them patched in 2019 and still being used against live systems today.
This is not threat intelligence designed to sell you something. This is the current state of the KEV catalogue and the NVD critical feeds as of 27 August 2026. Here is what the data actually shows, and what you need to do about it.
The SQL Server Problem Nobody Wants to Talk About
CVE-2019-1068. Microsoft SQL Server. Remote code execution vulnerability. CISA added it to the Known Exploited Vulnerabilities catalogue on 26 August 2026.
The patch for this has been available since 2019. Seven years. The vulnerability allows an attacker to execute arbitrary code in the context of the SQL Server Database Engine service account. In practical terms: if an attacker can reach your SQL Server instance, they can run code on it with database-level privileges.
The fact that this is still being actively exploited in 2026 is not a sophisticated threat actor problem. It is a patch management problem. Organisations are running SQL Server instances that have not received security updates in seven years, and attackers know it.
If your business runs Microsoft SQL Server, whether on-premises or managed by an MSP, the question to ask right now is simple: when was this last patched? If your MSP cannot answer that question immediately, that is a problem worth raising before this one is.
WordPress: The Avada Theme and What CVSS 9.8 Actually Means
CVE-2026-18431. The Avada theme for WordPress, combined with its companion Fusion Builder plugin. CVSS score: 9.8. Published 26 August 2026.
Avada is one of the most widely used commercial WordPress themes in the world. Hundreds of thousands of active installations. The vulnerability is a chain of two weaknesses: an authorisation failure and an input validation failure across the theme and plugin combination. The result is that an unauthenticated attacker, meaning someone with no username or password, can write attacker-controlled files to your web server and execute arbitrary PHP code.
Complete site compromise. No credentials required.
A CVSS score of 9.8 is not marketing language. It reflects the combination of network accessibility, no authentication requirement, and the ability to achieve full remote code execution. This class of vulnerability is what attackers scan for at scale. Automated tools probe millions of WordPress installations looking for exactly this pattern.
The fix: Avada must be updated to version 7.17 or later. Fusion Builder must be updated to version 3.17 or later. Both updates must be applied. The vulnerability requires both components to be present; updating only one is not sufficient.
Separately, also worth noting this week: the TranslatePress plugin (CVE-2026-19632), used on over 400,000 WordPress sites, has a critical vulnerability allowing unauthenticated account takeover via password reset link interception. A security update has been available since 13 August, but a significant number of sites have not applied it. If you use TranslatePress, check your version today.
Gitea: The Developer Tool That Became an Attack Surface
CVE-2026-60004. Gitea, the self-hosted Git service used as an open-source alternative to GitHub. Actively exploited. CISA confirmed it on 26 August. At least one reported attack dropped a miner-like payload.
Gitea is used by development teams, software agencies, and any business that manages its own code repositories internally. The vulnerability allows an attacker with write access to a repository to inject malicious Git hooks that execute arbitrary shell commands when triggered. With open registration enabled on a public-facing Gitea instance, an unauthenticated visitor can register an account, create a repository, and achieve remote code execution.
If your business or your development partner runs a self-hosted Gitea instance, particularly one with open registration or public internet exposure, the risk is direct. The fix is to update to the patched version and disable open registration if it is not operationally required.
The payload observed in the wild was miner-like, meaning attackers are using compromised infrastructure for resource abuse. That is the low end of what these access levels enable. The same foothold that installs a miner can install ransomware.
How This Gives You an Edge
The businesses that respond to active exploitation alerts quickly are not the ones with the biggest security budgets. They are the ones with a clear inventory of what software they run and a process for checking it.
Knowing that CVE-2019-1068 is being actively exploited today means you can go to your MSP or IT provider with a specific, verifiable question: is our SQL Server instance patched against this CVE? A good provider will answer within the hour. A provider that cannot answer that question is not managing your infrastructure adequately.
The same applies to WordPress. Knowing which themes and plugins your site uses, and checking their version numbers against current advisories, is a fifteen-minute task that eliminates an entire class of risk.
Suppliers and clients increasingly ask about security practices. Being able to demonstrate that your business responds to active exploitation intelligence within 24 hours is a concrete, verifiable signal of security maturity. Most of your competitors are not doing this.
Making the Business Case
Three arguments for investment in patch management that will hold up in a board conversation:
The cost of exploitation vastly exceeds the cost of patching. A SQL Server compromise can result in data exfiltration, ransomware deployment, and regulatory notification obligations under UK GDPR. The ICO does not accept “we hadn’t patched it” as a mitigation. It reads as aggravating.
Active exploitation means real attacks, not theoretical risk. CISA’s Known Exploited Vulnerabilities catalogue reflects confirmed exploitation by real threat actors. These are not proof-of-concept demonstrations. The vulnerabilities listed this week are being used in live attacks right now.
Patch management is auditable. Cyber Essentials, the UK government’s baseline certification scheme, requires that software is patched within 14 days of a critical update being released. CEV-2019-1068 is now seven years old. Any organisation seeking Cyber Essentials certification while running an unpatched SQL Server instance will not pass. The certification requirement and the security requirement are, in this case, identical.
What to Do Before Friday
1. Check your WordPress installations. Log in to every WordPress site your business runs. Navigate to Appearance > Themes and Plugins > Installed Plugins. Check Avada and Fusion Builder versions. If either is below the patched version (7.17 and 3.17 respectively), update immediately. Check TranslatePress while you are there.
2. Verify your SQL Server patch status. If you run Microsoft SQL Server, ask your IT provider or MSP for confirmation that CVE-2019-1068 has been remediated. Request the specific patch level or version number. Document the response. If they cannot confirm within 24 hours, escalate.
3. Audit your Gitea exposure. If your business or any development partner runs a self-hosted Gitea instance, confirm it has been updated to the patched release and that open registration is disabled unless operationally necessary. If you are unsure whether you use Gitea, ask your developers.
4. Enable automatic updates where practical. For WordPress core, themes, and plugins, automatic minor updates can be enabled without meaningful operational risk for most small business sites. The manual update model is fine until a week like this one, when three critical flaws land simultaneously.
5. Ask your MSP for a patch status report. A managed service provider should be able to produce a report showing the current patch status of all managed systems. If yours cannot, or will not, that is a service gap worth addressing before the next round of active exploitation.
Follow the show wherever you listen. Leave a rating or a review; it genuinely helps more people find the briefing. Drop a comment with your thoughts, or with any questions about this week’s vulnerabilities. And if you know someone running a WordPress site or a SQL Server instance who hasn’t heard this yet, share it with them. Today, not next week.